Google BoringSSL Fixes Two Certificate Name-Constraint Bypasses
Two legacy BoringSSL name checks were fixed in March; a URI case remains under coordination. Find the validator your product actually uses.
Read article →appsec
Software vulnerabilities, dependencies, and application security.
Latest in appsec
Fortinet FortiSIEM Flaw Lets Remote Attackers Run Code
Crafted packets can cross a file-path restriction in FortiSIEM 7.5.0. Upgrade to 7.5.1 and limit access to TCP/27918 while scheduling the change.
Read article →
Microsoft and NVIDIA Map Open-Weight Model Risk to Enterprise Deployments
The joint guidance separates model evaluations from the permissions, data access and tools of the application that uses a model.
Read article →
Fortinet FortiSandbox Flaw Lets Remote Callers Bypass GUI Login
Crafted HTTP requests can bypass FortiSandbox management login. Check appliance and PaaS versions, upgrade affected branches and restrict GUI reachability.
Read article →
Komodo Log Access Lets Restricted Users Run Commands on Managed Hosts
Komodo Periphery passes some restricted-user requests to a shell on managed servers. Upgrade agents to 2.3.0 and review Logs and Execute grants.
Read article →
Lowcoder Flaw Lets One Tenant Run Another Tenant's Saved Queries
An admin or developer in one organization can reach another's Query Library on a shared instance. Restrict the affected API while a security update is pending.
Read article →
Bisheng SSO Issues Admin Tokens Without Checking the Caller
The legacy SSO route issues a JWT for a supplied username and remains unpatched; separate cross-user assistant and workflow flaws have release-specific fixes.
Read article →
Shopware media uploads expose admin tokens to stored XSS
An uploaded HTML file can run in a Shopware administrator's browser. Restrict media creation or block HTML uploads while checking who can reach existing media.
Read article →
GitLab fixes CI regex flaw that permits server-side code execution
A crafted CI configuration and UTF-8 repository path can reach a vulnerable regex compiler on self-managed GitLab. Upgrade the affected 19.2, 19.3 and 19.4 branches.
Read article →
Apex Accelerator's fake audits deliver malware through npm tools
Two Apex npm tools fetch executables and attacker-selected commands; one also sends coding-agent conversations to an Apex server. Find the tools and revoke exposed secrets.
Read article →
Thelia back-office flaws expose store servers to code execution
CERT/CC details code-execution paths in Thelia 2.6; a separate Thelia 3 email-template flaw has a module fix. Restrict admin access and check permissions.
Read article →
CISA lists exploited Strapi filter flaw that exposes private fields
Strapi user filters can disclose reset tokens. Find vulnerable releases, inspect GET requests for private-field probes and move to a patched branch.
Read article →
AhsayCBS Intruders Install Webshells and Hide a Crypto Miner
A backup management server became a SYSTEM-level foothold. Restrict its web interface and hunt for a fake Edge service, JSP shells and miner traffic.
Read article →Showing 1–13 of 88